Revision history [back]

Wireshark shows SMB path and File name in 8.3 file format, but only from time to time?

Has any one seen in an SMB capture that the client will send what seems to be file path and name in 8.3 file format, even though both SMB2 is used and the Client is a Win10? Most of the times it does use the normal file format to send its requests . I wonder if this is a Client issue or the Wireshark just not showing it properly?

Here is a good example from the SMB2 Create Request: Filename: Energie_GmbH\04_WET\03_Angebote\140220_4601000136_Bachert.pdf

And Here is a not so good one: Filename: ENERGI~1\04_wet\03_ANG~1\140220~1.PDF

I wanted to upload a screenshot, but the system would not allow me to. Both of the above are sent from the same Clients within a few packets of each other and I strongly suspect that it is the same file. I am not sure if that is a problem or not, but jumps out when I look at the captures.

And some background of the problem. User connects to the shared drive and tries to open some PDF files. They could not open any files for a few minutes and then the problem disappears for a few hours. After that all repeats. User is Win10 and Share is NetApp.

Wireshark shows SMB path and File name in 8.3 file format, but only from time to time?

Here is a good example from the SMB2 Create Request: Filename: Energie_GmbH\04_WET\03_Angebote\140220_4601000136_Bachert.pdf

And Here is a not so good one: Filename: ENERGI~1\04_wet\03_ANG~1\140220~1.PDF

Wireshark shows SMB path and File name in 8.3 file format, but only from time to time?

Here is a good example from the SMB2 Create Request: Filename: Energie_GmbH\04_WET\03_Angebote\140220_4601000136_Bachert.pdf

 And Here is a not so good one:
Filename: ENERGI~1\04_wet\03_ANG~1\140220~1.PDF
 I wanted to upload a screenshot, but the system would not allow me to. 
Both of the above are sent from the same Clients within a few packets of each other and I strongly suspect that it is the same file. 
I am not sure if that is a problem or not, but jumps out when I look at the captures.
 And some background of the problem. 
User connects to the shared drive and tries to open some PDF files. They could not open any files for a few minutes and then the problem disappears for a few hours. After that all repeats. User is Win10 and Share is NetApp.

          4    retagged 
      
    
        
        updated 2018-05-24 21:01:45 +0000  
    Eddi  
 2379  ●8 ●48 ●59  
 
 
 
  
 
 
 
  Wireshark shows SMB path and File name in 8.3 file format, but only from time to time?
 Has any one seen in an SMB capture that the client will send what seems to be file path and name in 8.3 file format, even though both SMB2 is used and the Client is a Win10? 
Most of the times it does use the normal file format to send its requests . I wonder if this is a Client issue or the Wireshark just not showing it properly?
 Here is a good example from the SMB2 Create Request:
Filename: Energie_GmbH\04_WET\03_Angebote\140220_4601000136_Bachert.pdf
 And Here is a not so good one:
Filename: ENERGI~1\04_wet\03_ANG~1\140220~1.PDF
 I wanted to upload a screenshot, but the system would not allow me to. 
Both of the above are sent from the same Clients within a few packets of each other and I strongly suspect that it is the same file. 
I am not sure if that is a problem or not, but jumps out when I look at the captures.
 And some background of the problem. 
User connects to the shared drive and tries to open some PDF files. They could not open any files for a few minutes and then the problem disappears for a few hours. After that all repeats. User is Win10 and Share is NetApp.